Driving School & Rider Training Booking

The vertical decides the vocabulary, the questions asked at checkout, the inventory model, the door, the payout terms and the theme. This page says "place" and "course" because that is what a school says; a config whose primary call to action is generic ticketing wording fails validation rather than shipping.

The permit arrives after the money has already moved

The booking system takes the card and the paperwork follows: a confirmation email asking the learner to bring their permit to the first lesson. Most of them do. The ones who do not are the entire problem, because it is discovered at the kerb at quarter past nine with a car booked, an instructor paid for the hour and a learner who has already been charged. The permit is at home, or it is a photograph of an application rather than a permit, or the name on it is not the name on the booking. Teaching anyway is the option nobody writes down and the one that ends an insurance conversation badly. Sending them home is a wasted slot, an argument about a refund and a review written in a car park. The failure is not that the school checked late — it is that the money moved first, which turned a compliance check into a commercial negotiation with somebody who has already paid.

What bindro does: The permit number and the permit image are fields on the booking, checked on the money path rather than in the browser, so an incomplete enrolment is refused with the missing field named and no order behind it. Then application review moves the whole decision in front of the payment: with it on, a booking files as an application, no order is created and no payment intent exists, the learner is told it is with the school, and their place is held while you look. The one thing it does not do is decide — no permit is validated by anything in bindro — so the judgement stays yours, and what changes is that you make it on Wednesday in the office instead of at the kerb on Saturday.

The consent form was ticked by whoever was holding the phone

Under-18 learners are a large share of the intake for most schools, and the consent that protects the school is almost always collected in the weakest possible way: a checkbox on a form the learner filled in themselves, or a parent’s name typed by the learner, or a paper slip that comes back on the first evening signed in handwriting suspiciously like a seventeen-year-old’s. Nobody sets out to do this. It happens because the booking is made by the person who wants the lessons, at eleven at night, on a phone, and the form has no way of reaching anybody else. It is noticed on the one day something goes wrong, by somebody whose whole job is to ask who signed this and how you know — and "the box was ticked by the same device that paid" is not an answer.

What bindro does: The form asks whether the learner is under 18, and if they are it asks for the parent or guardian’s own email address rather than the booker’s. Confirming the order raises a countersign request inside the same transaction as the payment, and the guardian is emailed a link to a page where they type their own name to sign. Until they do, that learner’s pass does not admit them: check-in refuses it, so an unsigned consent is a door refusal rather than a warning nobody reads. The booker’s own checkbox stays what it honestly is — the buyer’s commitment — because the person filling in the form is often the school or the learner. Under-14 bookings are refused when they are made, with the rule named, and a date of birth the platform cannot read is refused too rather than waved through. The consent record keeps ten years, which is longer than the learner’s own details are kept.

The nine o’clock cancels at eleven the night before

Late cancellation is the whole economics of a driving school, because the thing being sold is an hour of one person’s time in one car and it cannot be resold at nine o’clock the same evening. Schools respond with a notice period — forty-eight hours is the usual — and then spend real administrative effort enforcing it one conversation at a time, against learners who are seventeen, broke, and genuinely sorry. The money is not usually the worst part. The worst part is that the rule lives in a terms page nobody read, so every enforcement of it is a surprise, and a school ends up choosing between the fee and the relationship several times a week.

What bindro does: Your notice period is a setting, and bindro enforces it for you. On the refund policy page you publish the hours before the start at which self-service refunds stop and the share you keep inside that window; a learner cancelling at eleven the night before then has the rule applied to them by the software, in the same act — your share kept, the rest back to their card, the booking ended and the place back on sale — with no conversation and no enforcement effort from you. Publish nothing and the default is the one schools assume: everything refundable, in full, until the first session starts. What the platform still cannot do is charge a learner who simply does not arrive, and past the start time the decision is yours in the console. Refunds reverse in a fixed order — your proceeds first, then tax, then the platform fee — so giving money back never leaves you paying a fee on a sale that was undone.

A six-week course is six different registers by week three

A structured course is sold as one thing and run as six evenings, and those two facts come apart almost immediately. The classroom holds twelve and the in-car sessions hold two. One learner misses week three and asks to pick it up on the next course. Another comes to four evenings out of six and assumes that is enough. The only record of who was actually in the room on which night is a clipboard in the boot of a car, and by week five nobody can say with confidence whether the learner sitting in front of them has done the night that the certificate is supposed to be issued from. That register is the one artefact a school genuinely needs later — for its own files, for an insurer, for whatever its state authority asks for — and it is the one thing the booking system never had.

What bindro does: A course is one event with a session per evening, generated as a series rather than typed date by date, and every session carries its own capacity, its own register and its own attendance record. Twelve in the classroom and two in the car is expressed rather than remembered, and the platform refuses the thirteenth booking rather than letting you find out. Your staff open the session on a phone and see who is booked: a learner either shows the code from their email, which is scanned, or is found by name and tapped — a name list is the primary method in this vertical and scanning is the quick path rather than the only one. The count updates live, and a second scan of the same code at the same device readmits the learner rather than counting them twice. A learner who missed week three is visibly missing from it afterwards, which is what a certificate is issued from.

The employer wants an invoice and the booking form wants a card

Fleet drivers, council staff, agency riders and apprentices sent by a college all buy the same way, and it is never with a card in the room. It is a purchase order, an accounts-payable address and thirty-day terms. The booking system wants a card number, so the places get held on trust in a notebook, the invoice is raised out of an accounting package that knows nothing about the course, and the join between the two lives in one person’s head until they take a fortnight off. The failure is rarely an employer who refuses to pay. It is a course that ran with six places nobody ever billed for, found at the end of a busy quarter.

What bindro does: The checkout offers to invoice the organisation, and an invoiced booking confirms with no card at all — the invoice branch sits above the provider checks, so an employer booking works even where card processing is not configured. Bindro raises a numbered bill for a total it works out itself, carrying their purchase-order reference and your terms, commits the places immediately, sends the bill to accounts payable and the joining details to the drivers. The accounting is the careful part: raising an invoice writes no ledger entry whatsoever, so your balance cannot carry places nobody has paid for and a payout can never be funded by an outstanding bill. An invoice that passes its due date unpaid is voided automatically and its places go back on sale — the one path in the whole platform that returns inventory, and usually exactly what a school wants in the week before a course somebody promised to pay for. A booking taken at the counter or over the phone goes through the console onto the same place pool, asking the same permit and guardian questions the public form asks.

The course fills, and the six people who asked after it are in a text thread

Demand for driving courses is spiky and local: a test-date change, a school holiday or one recommendation in a parents’ group and a course fills in a day. What happens to the next six enquiries is the difference between a good month and an average one, and in most schools what happens is a text thread and a promise to call when something opens up. Nobody calls, because nobody knows when something opened up. Then a learner drops out, the place is quietly wasted, and the school’s impression is that demand went away.

What bindro does: A full course shows a join form instead of a dead end, and joining twice does not buy a better place in the queue. When a place is genuinely free the worker promotes the entry at the front with a time-boxed hold and a link into the normal checkout, so it is theirs to claim for a day rather than a race. Read "free" strictly, because it is the part schools assume the other way: a plain refund does not return the place to the pool, so a refund on its own promotes nobody. The queue moves when a learner cancels inside a window you published with a share you keep — which ends the booking and puts the place back on sale in the same act — when an abandoned hold lapses, when an unpaid invoice is voided, or when you raise the capacity yourself.

A permit gate the checkout cannot go round

This is the capability the vertical is built on, and all of its value is in the fact that the gate is a person. Bindro does not verify permits. What it does is make it structurally impossible for money to move before somebody at the school has opened the document, which is the only arrangement in which the check can honestly be made at all.

• With application review on, a booking creates no order and no payment intent — there is nothing to capture, so no sequence of events can charge a learner by accident.
• The place is held while the application waits, so looking properly does not cost you the sale to somebody quicker.
• The approvals queue lists what is waiting with the submitted answers beside each one and a link that opens the uploaded permit, because a document you have to look at is the only kind that is being checked.
• Approving emails the learner a link to pay; rejecting releases the place, tells them, and scrubs what they submitted.
• It is per course, so a refresher evening can sell instantly while the full beginner course beside it is gated.
• The permit number is required, stored and never validated; the image is stored for your staff to open, and nothing in the platform reads it. Nothing here is checked against any authority, and no page on this site says otherwise.
• A booking taken over the phone through the console is held to all of it, so a counter sale cannot skip the permit or the guardian’s email.

Guardian consent that is enforced at the door, not filed in a folder

Consent for a minor is the compliance artefact a driving school is most likely to be asked about and least likely to be able to prove. Bindro treats it as an act by a specific adult with a consequence attached, rather than as a field on a form.

• The under-18 question is asked of every learner, and answering yes reveals the guardian’s own name and email rather than reusing the booker’s.
• The countersign request is raised inside the same transaction as the payment, so an order cannot exist without one waiting.
• The guardian opens their own link and types their own name; nobody else can complete it for them.
• Until it is signed, that learner’s pass does not admit them — check-in refuses it, however good the booking looks.
• The liability waiver is signed the same way at booking, and its acceptance record is written in the same transaction as the payment rather than emailed and hoped for.
• Fourteen is the platform’s floor and it is enforced on the money path, with the rule named; an unreadable date of birth is refused rather than accepted.

A course that is a series of sessions, each with its own capacity and register

The inventory model here is a session series, which is the shape a driving course actually has: one thing a learner enrols on, several dates it runs over, and a different number of places available on each of them. Modelling it properly is what stops the classroom evening and the in-car hours fighting each other.

• One event, a session per date, generated from a cadence rather than typed out — which matters when the same course runs every fortnight all year.
• Per-session capacity, so twelve in the classroom and two in the car is a constraint the checkout enforces rather than a note in a diary.
• Check-in per session, by scanning the code or tapping a name, with the count updating live and a repeat scan reported as a duplicate.
• Inventory moves only under a row lock inside the confirming transaction, with a database constraint behind it, so two learners cannot take the last place in the same second.
• Sell from the course’s own page, or embed the checkout in the site you already have — usually the better of the two, because sending a local searcher to a platform-branded page is a conversion cost with no upside.
• The door needs a signal: offline check-in is not declared for this vertical, so load the register before you leave for a meeting point with no coverage.
• The hosted checkout sells one session per order today; multi-session orders go through the JSON API or the console.

Employers, fleets and colleges billed on terms with no card in the room

Business bookings are a third of the work for a lot of schools and the part every consumer booking system handles worst. Bindro treats an invoice as what it is — a promise, not a payment — which is what keeps the places and the money honest.

• The booking confirms with no card, the places are committed and the passes go out; the bill goes to accounts payable carrying their purchase-order reference and your terms.
• Raising an invoice writes no ledger entry, so your balance never carries places nobody has paid for and a payout cannot be funded by an outstanding bill.
• Recording the remittance moves the invoice, the order and the ledger together, and recording it twice is refused.
• Numbering is gapless per organisation, under a row lock, because a finance department notices a gap.
• An unpaid invoice past its due date is voided automatically and its places return to sale — the only path in the platform that returns inventory.
• Sales tax, where you set a rate, is derived server-side and lands on a tax-payable account rather than in your balance, so collected tax cannot be paid out to you by accident.
• Only the roles you grant can do any of it: recording a payment is a finance action, and an instructor with a door login cannot reach it by typing the URL.

Certificates issued from attendance, not from the sale

A school is asked for proof of training far more often than it expects, usually months later and usually by somebody who will not accept a booking confirmation. Bindro issues its own certificate, and the whole design of it is that it is issued from the register rather than from the receipt.

• Issue for a session in one action once it has ended; a session that has not finished yet is refused, because a certificate issued from a sale is worth nothing.
• Only learners with a check-in record get one — attendance is the qualifying fact, not payment.
• Hours come from the session’s length and each certificate carries its own serial; re-issuing never duplicates a credit.
• Be exact with learners about what it is: your school’s record that this person attended for these hours. It is not a state completion certificate.
• Bindro transmits it to no authority. Whatever your jurisdiction requires you to file, you file exactly as you file it today.
• Everything behind it exports as CSV — who enrolled, who attended which session, what they paid — so the record is yours to keep and yours to take.

Filling the places back up when somebody drops out

The other half of running a small school is the demand you already have and cannot see. Everything here is ordinary and unglamorous, and between them these are the difference between a course that runs at eight and the same course at twelve.

• A waitlist on a full course, deduplicated, promoted from the front with a time-boxed hold and a link into the normal checkout.
• Promo codes for a returning learner or a referral, validated at checkout rather than typed into a price.
• Comp places that consume inventory and check in normally but write no revenue lines, so a goodwill place never distorts what a course earned.
• Your learners as a list you own — a follow-up email after the course, and the whole roster as CSV behind a one-time code.

Who pays the booking fee?

The learner, unless you say otherwise. Every course carries its own setting — the learner pays, you absorb it, or you split it — and the fee itself does not change with the choice, only which side of the sale it comes from. On a ten-place $25.00 course that is $16.20 either added to what learners pay or taken out of what you keep.

Because the default is the learner, a school can go from signing up to a sold-out course without paying bindro anything up front, at any point, ever. We are paid out of sales that happened or we are not paid.

The word "event" is load-bearing and worth reading twice. The scheduler groups by course, admits one only once its LAST session has ended, and pays it once. A course sold as a run of dates therefore pays after the final date, not after each one — a season's float is not something an operator should discover halfway through the season.

Bindro never pays before delivery, in any vertical. A pre-event advance is a configuration violation platform-wide rather than a policy someone can be talked out of, because paying out on courses that have not happened is exactly how a cancellation becomes learners with no refund. "Paid" also means the money moved: a payout only reaches its paid state with a real transfer reference attached, enforced by the database rather than by a status field someone can set.

• One payout per course, after its last session ends, one in flight at a time.
• T+2 for this vertical (medium risk tier), with 13.5% held as reserve and released later.
• Refunds reverse in a fixed order — your proceeds first, then tax, then our fee — so a refund never leaves you charged for a sale that was undone.
• Sales tax, where it applies, is held as a liability rather than mixed into your balance, so the payout figure is proceeds rather than a number you still have to do subtraction on.

It answers "is my week full", not "is my week profitable": an assigned lesson is an hour committed whether its seats sold or not. Read it beside the fill rate on the same page — high utilisation with low fill is instructors teaching half-empty lessons, which neither figure says alone.

What it is not is a rota: no shift pattern, no holiday, no availability calendar. The one thing enforced is that a person cannot be assigned to two overlapping lessons, refused outright rather than warned about. For utilisation per instructor across a month, the rows come out as CSV and the pivot is yours.

The three figures this vertical is scored on beside it deserve very different degrees of confidence. Reschedule rate is partly real: deferrals are countable, and so are refunds taken before a course started. A learner moving their own lesson from Saturday to next month is countable too: the booking moves date, the released place goes straight back on sale, and no money changes hands. Pass rate is now recorded by the school rather than observed by bindro — a member of staff marks a learner passed, failed or incomplete once the course has run, and the rate is those marks. bindro still never sees a test result and receives nothing from any licensing authority, so the number is your record of your own judgement, which is the thing a regulator asks you for. Instalment default rate counts plans whose charges have used every retry; what it will not tell you is that a card was declined unattended, because nothing bills unattended yet.

The segments split the same way, and one of them is a deliberate refusal rather than a gap. Course type is genuine and falls straight out of the event. Instructor is real for the hours side — an instructor is a row, a lesson is assigned to one, and the same person cannot be put on two overlapping hours — though the analytics page still does not pivot the rest of its figures by them. Payment plan segments once you publish one. And age band is excluded on purpose: every learner row in this vertical is health-classed, because the under-18 question is asked of everybody, which keeps those answers out of analytics exports and out of every AI feature with no setting that turns it off. A platform that let you segment a cohort of minors by age band in a marketing report would be doing something worse than being unhelpful, so bindro does not, in any vertical, under any configuration.

What the console shows today, without an integration or a spreadsheet:

• Gross, platform fees and refunds per course, read from the ledger the payouts reconcile against.
• Places sold against learners checked in, with a no-show percentage per session.
• Live remaining capacity while the course is running, per pool, on the day-of screen.
• This school's own funnel — view → availability checked → documents uploaded → approved → paid → attended — stage by stage with the drop-off between them, and any step the platform cannot see said so rather than shown as a zero.
• Refunds, transfers, turnout, no-shows, add-on attach and repeat buyers, each printed with the two numbers it was divided from.
• Orders and learners as CSV, so anything not on the screen is one export away.

Two more that are worth stating plainly. Sensitive answers are classified on the field rather than by convention, and health data is excluded from analytics exports and from AI context absolutely, with no override in any vertical. And a school's own people see only what their role allows — a door login sees a name and whether the code admits, not what anyone paid — which is checked in the handler rather than by hiding a button.

• No fleet rate or family rate. Prepaid lesson blocks DO work — you publish a block of credits, a learner buys it and spends one per lesson, and the money is held as a liability until a credit is used. What is refused is the group-registration capability this vertical does not declare, so a per-quantity fleet or family price cannot be published; publish a separate course at a separate price instead.
• bindro enforces the cancellation terms you publish, and nothing beyond them. Publish nothing and the platform default applies: a learner refunds themselves in full from the link in their confirmation email at any time up to the moment the first session starts. Publish a notice window and the share you keep inside it and bindro applies both — it keeps your share, returns the rest, ends the booking and puts the place back on sale — but a school that publishes a window and keeps nothing gets a request to decide instead. What no terms can do here is charge a learner who simply does not arrive, hold a card against that, or add an admin fee on top of the share you published. After the start time the decision is yours in the console.
• A refunded or deferred place does not go back on sale by itself: the money moves and the seat stays counted, so raise the pool capacity by one to resell that slot.
• A learner reschedules to another DATE OF THE SAME COURSE and nothing else. From their own booking page, up to the notice window in your published terms, the place moves and comes straight back on sale on the old date. It cannot move them to a different course, and a booking spanning several dates has to be moved by the school. Deferral is the other tool and is unchanged: a credit code worth what they paid, spendable for twelve months, and only the school can start it.
• The BALANCE of a payment plan is not collected automatically. A school publishes the deposit, the number of charges and the interval on the ticket type and the deposit is taken at checkout, but bindro never charges the stored card for the rest: off-session charging is armed by a separate switch that is set in no environment, because a sweep bills somebody with nobody present. Collect the balance yourself on the published dates.
• An instructor is a name and a weekly hour count, not a diary. You register your instructors, assign one to each lesson, and the platform refuses to put the same person in two overlapping hours — so utilisation is measured in hours rather than guessed from seats. What it is NOT is a rota tool: there is no shift pattern, no holiday, no availability calendar to publish against, and nothing about cars, servicing or mileage.
• Nothing is reported to a DMV or state licensing authority and nothing is verified with one. The permit number is a text field bindro never checks; the uploaded permit is bytes for a human to look at. The completion certificate bindro prints is its own — hours, a serial and verified attendance — and is not a state-recognised certificate.
• No offline door for this vertical. Check-in is a name list that needs a signal, so a meeting point with no coverage is worked from a list loaded before you left.
• No handing a place to another learner. A learner who cannot come is refunded or deferred; there is no transfer that renames the pass.
• An adult learner’s details — date of birth, permit number, emergency contact — are anonymised twelve months after their last session, because the under-18 question makes the row health-classed. An under-18’s row is not on a timer: it is kept until the learner or their guardian asks, from the booking’s own privacy page. The waiver record keeps seven years and the consent record ten, so what survives is the proof, not the file.

If one of those is the thing you need, say so — the answer is a capability declared, built and gated properly, or a straight no. It is never a feature flag that collects the request and does nothing.

The session structure is the decision worth taking slowly, because everything else hangs off it and changing it after learners have enrolled is much harder than getting it right first. A session is the unit of capacity, the unit of the register and the boundary a certificate is issued on, so the sensible shape follows the dates you actually run rather than the way the course is advertised. Six evenings is six sessions. A theory evening plus four in-car hours is five, if you want to know who came to each of them — and you do, because that is what attendance questions are answered from later.

Then decide, per course, whether it is gated. A refresher for somebody who already holds a licence can sell instantly. Anything where you need to see the permit before you commit the car should have application review on before a single place is sold, because turning it on afterwards does not retrospectively un-take the payments already made. Set the price — a flat price per place, for the reasons in the limits below — and choose whether the booking fee is added at checkout or comes out of your proceeds. The default is that the learner pays it, which is why a school can go from signing up to a full course without paying bindro anything.

Where you sell from is the last decision and the easiest to get wrong. For a driving school the embedded checkout is usually the better answer: somebody who searched for lessons in your town and landed on your site should not be sent to a platform-branded page to finish. Anybody who telephones is booked from the console onto the same place pool, asked the same questions.

• Structure sessions on the dates you actually run — capacity, the register and the certificate all follow the session.
• Turn application review on before you sell anything you would want to see a permit for, not after.
• Publish a flat price per place; there is no pack, no block and no group rate in this vertical.
• Embed the checkout in your own site rather than sending local searchers to a platform page.
• Load the register before you leave — this vertical has no offline door.

The split is stated this precisely because a four-figure course is exactly the product where a payment plan changes who can buy, and "instalments" on a feature list can mean either half. What you get is the whole of the first half: three numbers on the course, a plan the learner is shown and chooses, a deposit taken at checkout, and a schedule the database defends — the instalments must total exactly the balance owed, enforced by a constraint trigger rather than by the code that writes it; a charge cannot be recorded as paid without the provider reference proving it happened; a plan cannot be marked complete while any charge is outstanding; and the plan’s money rests on its own liability account until the final charge clears, so a half-paid course can never appear in a payout.

Until that switch is armed, the later parts are a schedule you work from rather than money that arrives, and the instalment default rate on your dashboard exists to tell you who has stopped paying.

Where a plan is not what you want, the shape of the product still does the job: publish the stages of a long course as separate courses at separate prices, so a learner commits to the first block and books the next when they are ready — which is closer to how somebody learning to drive actually budgets. That is not a payment plan, and it is not described as one anywhere on this site.

What bindro replaces is the layer underneath the licensing: the enrolment, the documents, the consent, the money, the register and the door — the layer most schools run on a form, a card terminal and a shared inbox, and the one where the expensive mistakes are. The authority layer above it is not something a booking platform should pretend to touch.

What the platform does guarantee is narrower and more useful than a verification claim: that the number was typed and the document was uploaded before the booking could complete, and — where you turn application review on — that no money moved until one of your staff opened the image. Whether the permit is good is a human judgement, and it stays with the human qualified to make it.

The one thing that looks adjacent is the completion certificate, and it is the sentence most likely to be misread on this page, so here it is precisely. The record you issue from a finished session is your own school’s: it is not a state completion certificate, no authority recognises it, and nothing about it is transmitted anywhere. A learner who expects a licence from it has been given the wrong impression by somebody, and it should not be this site.

That split is deliberate and a school should decide about it before it stops keeping paper, which is why it is on the landing page rather than in a support article. Seven years of the signature is the right answer for a liability waiver: it is the artefact a claim turns on. Ten years of the consent is the right answer for a minor, whose ability to bring a claim does not start until they are an adult. But if your state authority or your insurer expects to see the permit itself years afterwards — and some do — the platform will not have it. Export what you need while it is live; the export is unrestricted and behind a one-time code.

Inside those twelve months, access is narrower than the average school office is. The submitted answers and the uploaded permit are read in the approvals queue, on order-write, and the answers again on the learner’s own record, on attendee-read — an owner, a manager or a finance user has both, and an instructor given a door login has neither. The door login sees a name and whether the pass admits. It does not see what they declared or what they paid, and it cannot get there by typing the URL, because the refusal is in the handler rather than in the navigation. Hiding a link has never been authorisation here.

The upload has the same discipline. A document reference that does not resolve to that booking’s own upload is refused on the money path, so nobody can attach somebody else’s permit to their enrolment and an invented reference does not confirm a booking. If you reject an application, what the learner submitted is scrubbed rather than retained — a rejected learner’s documents should not accumulate in your queue, and they do not.

The collection limit is the one most likely to surprise, and the deposit question above answers it in full: you take the deposit and you collect the rest. There is no group, fleet or family rate either — an employer buying six places pays the published place price on one invoice.

Rescheduling has an exact shape, published in the limits above: another date of the same course, moved by the learner up to the notice window in your published terms, with the place they leave going straight back on sale. Deferral is the tool for anything else, and its value sits as a liability until it is used, so you are never paid out for training somebody has not had. There is no transfer, so a place cannot be renamed and handed to a friend — the right answer where you have checked one person’s permit and hold one guardian’s signature.

The rest are operational. A refunded or deferred place stays counted against its session, so raise that pool’s capacity by one to resell it — the single most useful console habit in this vertical. The register needs a signal, so load it before you leave. An instructor is a name and a weekly hour count rather than a rota, so the diary itself stays where it is, and nothing about cars, servicing or mileage is modelled at all. And the general rule behind all of it is the useful part: a capability this vertical does not declare is refused by the engine with a hard error rather than quietly doing nothing, which is the failure mode that actually hurts, because it looks like it worked.